FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 308926
Description This article describes how to extend CMDB backup history.
Scope FortiSIEM.
Solution

Currently, FortiSIEM performs a CMDB backup twice a day. The first occurs at 3AM and the second occurs at 1PM. As the backup is saved at

/data/archive/cmdb/ by default, only the very last backup remains available. It can be useful to save these backups frequently to have a longer backup history. To do this:

 

  1. Add an empty 200GB disk to the FortiSIEM from the VM Platform or using a USB disk on a hardware machine.
  2. Locate it and format it with the preferred filesystem.

fdisk -l

FDISK.png

 

mkfs.xfs -f /dev/sdf

 

  1. Mount the disk:

mkdir /backup_history

echo "/dev/sdf /backup_history xfs defaults 0 0" >> /etc/fstab

systemctl daemon-reload

mount /backup_history

 

  1. Load the script. Copy the cmdb_backup_hist.sh script on /backup_history using winSCP and set the permissions accordingly:

chmod +x /backup_history/cmdb_backup_hist.sh

 

  1. Configure execution once every day at 4AM:


echo "0 4 * * * root /backup_history/cmdb_backup_hist.sh &> /dev/null" > /etc/cron.d/cmdb_backup

 

CMDB Backups will be stored at /backup_history/.

https://crontab.guru/ can help with defining schedules.

Check execution was successful with the 'journalctl -u crond.service' command.

Contributors